CVE-2026-42556

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-42556

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42556.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-42556

Aliases

GHSA-hhxq-3wg7-4rj8

Published

2026-05-08T22:28:33.086Z

Modified

2026-07-27T03:56:33.235863700Z

Severity

8.9 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L CVSS Calculator

Summary

Postiz stored XSS in public preview page

Details

Postiz is an AI social media scheduling tool. From version 2.21.6 to before version 2.21.7, any authenticated user who can create a post can store arbitrary HTML in post content by tampering their own save request and send the public preview link /p/<postId>?share=true to another user. The preview page renders that stored HTML with dangerouslySetInnerHTML on the main application origin. This issue has been patched in version 2.21.7.

Database specific

{
    "cwe_ids": [
        "CWE-79"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42556.json",
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/gitroomhq/postiz-app

Affected ranges

Type

GIT

Repo

https://github.com/gitroomhq/postiz-app

Events

Introduced

3ea302202dc0daa3db577eb7c68374cdc1ddbc3c

Fixed

7236213ea4520bd67b45688c2787d1f4586b3b51

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "2.21.6"
        },
        {
            "fixed": "2.21.7"
        }
    ]
}

Affected versions

2.*

2.21.6

v2.*

v2.21.6

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42556.json"